Source-reported · Independent verification status is not recorded for this article; claims remain attributed to their sources.
ScreenConnect Hackers Target IT Helpdesks, Turning Support Sessions Into Attack Vectors
Attackers using SCKit malware are now hijacking ScreenConnect remote support sessions to spread across managed service provider networks, even though the underlying critical flaw has been patched. The shift puts IT helpdesk technicians and their customers at the center of a new wave of supply-chain-style cyber risk.
A new wave of attacks against remote support software is turning the people meant to fix IT problems into unwitting conduits for compromise.
Security researchers warn that SCKit malware operators have shifted tactics to focus on ScreenConnect, a popular remote‑access tool used by internal helpdesks and managed service providers (MSPs). The malware exploits a previously disclosed, critical ScreenConnect flaw rated 9.9 out of 10 on standard severity scales. That vulnerability has been patched, but attackers have found another way in: seizing active technician sessions to move laterally across customer networks.
In practice, that means an IT support engineer who logs into a client’s machine to resolve a ticket could see their session silently hijacked. Instead of merely watching or controlling a single endpoint, the attacker uses the trusted ScreenConnect tunnel to deploy malware, exfiltrate data, or pivot deeper into internal systems — shielded by the same encryption and trust assumptions that make remote support workable at scale.
This approach is especially dangerous for MSPs that centralize IT for dozens or hundreds of small and mid‑sized businesses. A single compromised ScreenConnect server or technician account can give attackers a staging ground inside multiple organizations at once, turning routine troubleshooting into a supply‑chain threat.
The fact that the core vulnerability is patched but the risk persists matters. Many organizations treat patching as the end of a security incident. Here, the patch closes the initial exploit path but doesn’t prevent attackers from abusing legitimate remote sessions if they can steal credentials, trick technicians into running payloads, or piggyback on misconfigured instances. That gap underscores how tools that grant wide, persistent access can remain high‑value targets even when their headline flaws are fixed.
For frontline IT staff, the new campaign demands behavioral changes: more rigorous verification of which endpoints they’re connecting to, tighter controls on which users can initiate remote sessions, and quicker revocation of sessions that show unusual behavior. For security teams, it means putting more monitoring around helpdesk traffic — logging who connects where, for how long, with what privileges — and being ready to treat a remote support server compromise as an incident on par with a domain controller breach.
The economic stakes are significant. Many small hospitals, manufacturers, law firms, and local governments rely entirely on MSPs for IT. They rarely have deep in‑house security expertise and assume that patching core software is enough. If their service provider’s ScreenConnect environment is quietly abused, these organizations can find ransomware on critical systems or data siphoned off with no obvious sign of intrusion, because the attacker rode in on a legitimate tool used daily.
This kind of threat is now a pattern, not an anomaly. Earlier attacks on other remote management platforms have shown that when attackers compromise the software supply chain or the control plane of an MSP, they can hit many downstream customers at once. ScreenConnect’s current targeting suggests that adversaries are methodically working through the tools that bind corporate networks together.
A useful way to think about it: remote support software doesn’t just connect machines; it connects trust. Once that trust is abused, the blast radius is defined less by the malware family and more by where technicians are allowed to go.
Security teams should watch for vendor advisories about ScreenConnect and related platforms, updates to detection rules from major security companies, and any law enforcement or government alerts that suggest the campaign is expanding. MSP customers would be wise to ask direct questions about how remote access is managed and logged — not because the tools are optional, but because their new role in attackers’ playbooks is increasingly hard to ignore.